<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>PKI user authentication | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'pki-realm.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/pki-realm.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/pki-realm.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/pki-realm.html" rel="nofollow" target="_blank">../en/pki-realm.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="secure-cluster.html">Secure a cluster</a></span>
»
<span class="breadcrumb-link"><a href="setting-up-authentication.html">User authentication</a></span>
»
<span class="breadcrumb-node">PKI user authentication</span>
</div>
<div class="navheader">
<span class="prev">
<a href="oidc-realm.html">« OpenID Connect authentication</a>
</span>
<span class="next">
<a href="saml-realm.html">SAML authentication »</a>
</span>
</div>
<div class="section xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="pki-realm"></a>PKI user authentication<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/security/authentication/pki-realm.asciidoc">edit</a><a class="xpack_tag" href="https://www.elastic.co/subscriptions"></a>
</h2>
</div></div></div>
<p>You can configure Elasticsearch to use Public Key Infrastructure (PKI) certificates to
authenticate users. In this scenario, clients connecting directly to Elasticsearch must
present X.509 certificates. First, the certificates must be accepted for
authentication on the SSL/TLS layer on Elasticsearch. Then they are optionally
further validated by a PKI realm. See <a class="xref" href="pki-realm.html#pki-realm-for-direct-clients" title="PKI authentication for clients connecting directly to Elasticsearch">PKI authentication for clients connecting directly to Elasticsearch</a>.</p>
<p>You can also use PKI certificates to authenticate to Kibana, however this
requires some additional configuration. On Elasticsearch, this configuration enables Kibana
to act as a proxy for SSL/TLS authentication and to submit the client
certificates to Elasticsearch for further validation by a PKI realm. See
<a class="xref" href="pki-realm.html#pki-realm-for-proxied-clients" title="PKI authentication for clients connecting to Kibana">PKI authentication for clients connecting to Kibana</a>.</p>
<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="pki-realm-for-direct-clients"></a>PKI authentication for clients connecting directly to Elasticsearch<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/security/authentication/configuring-pki-realm.asciidoc">edit</a>
</h3>
</div></div></div>
<p>To use PKI in Elasticsearch, you configure a PKI realm, enable client authentication on
the desired network layers (transport or http), and map the Distinguished Names
(DNs) from the Subject field in the user certificates to roles. You create the
mappings in a role mapping file or use the role mappings API.</p>
<div class="tip admon">
<div class="icon"></div>
<div class="admon_content">
<p>You can use a combination of PKI and username/password authentication. For
example, you can enable SSL/TLS on the transport layer and define a PKI realm to
require transport clients to authenticate with X.509 certificates, while still
authenticating HTTP traffic using username and password credentials.</p>
</div>
</div>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p>Add a realm configuration for a <code class="literal">pki</code> realm to <code class="literal">elasticsearch.yml</code> under the
<code class="literal">xpack.security.authc.realms.pki</code> namespace. If you are configuring multiple
realms, you should explicitly set the <code class="literal">order</code> attribute. See
<a class="xref" href="security-settings.html#ref-pki-settings" title="PKI realm settings">PKI realm settings</a> for all of the options you can set for a <code class="literal">pki</code> realm.</p>
<p>For example, the following snippet shows the most basic <code class="literal">pki</code> realm configuration:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack:
  security:
    authc:
      realms:
        pki:
          pki1:
            order: 1</pre>
</div>
<p>With this configuration, any certificate trusted by the Elasticsearch SSL/TLS layer is
accepted for authentication. The username is the common name (CN) extracted
from the DN in the Subject field of the end-entity certificate. This
configuration is not sufficient to permit PKI authentication to Kibana;
additional steps are required.</p>
<div class="important admon">
<div class="icon"></div>
<div class="admon_content">
<p>When you configure realms in <code class="literal">elasticsearch.yml</code>, only the
realms you specify are used for authentication. If you also want to use the
<code class="literal">native</code> or <code class="literal">file</code> realms, you must include them in the realm chain.</p>
</div>
</div>
</li>
<li class="listitem">
<p>Optional: If you want to use something other than the CN of the Subject DN as
the username, you can specify a regex to extract the desired username. The regex
is applied on the Subject DN.</p>
<p>For example, the regex in the following
configuration extracts the email address from the Subject DN:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack:
  security:
    authc:
      realms:
        pki:
          pki1:
            username_pattern: "EMAILADDRESS=(.*?)(?:,|$)"</pre>
</div>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>If the regex is too restrictive and does not match the Subject DN of the
client’s certificate, then the realm does not authenticate the certificate.</p>
</div>
</div>
</li>
<li class="listitem">
Optional: If you want the same users to also be authenticated using
certificates when they connect to Kibana, you must configure the Elasticsearch PKI realm
to allow delegation. See <a class="xref" href="pki-realm.html#pki-realm-for-proxied-clients" title="PKI authentication for clients connecting to Kibana">PKI authentication for clients connecting to Kibana</a>.
</li>
<li class="listitem">
Restart Elasticsearch because realm configuration is not reloaded automatically. If
you’re following through with the next steps, you might wish to hold the
restart for last.
</li>
<li class="listitem">
<a class="xref" href="configuring-tls.html" title="Encrypting communications in Elasticsearch">Enable SSL/TLS</a>.
</li>
<li class="listitem">
<p>Enable client authentication on the desired network layers (transport or http).</p>
<div class="important admon">
<div class="icon"></div>
<div class="admon_content">
<p>To use PKI when clients connect directly to Elasticsearch, you must enable
SSL/TLS with client authentication. That is to say, you must set   <code class="literal">xpack.security.transport.ssl.client_authentication</code> and
<code class="literal">xpack.security.http.ssl.client_authentication</code> to <code class="literal">optional</code> or <code class="literal">required</code>. If
the setting value is <code class="literal">optional</code>, clients without certificates can authenticate
with other credentials.</p>
</div>
</div>
<p>When clients connect directly to Elasticsearch and are not proxy-authenticated, the PKI
realm relies on the TLS settings of the node’s network interface. The realm can
be configured to be more restrictive than the underlying network connection.
That is, it is possible to configure the node such that some connections
are accepted by the network interface but then fail to be authenticated by the
PKI realm. However, the reverse is not possible. The PKI realm cannot
authenticate a connection that has been refused by the network interface.</p>
<p>In particular this means:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
The transport or http interface must request client certificates by setting
<code class="literal">client_authentication</code> to <code class="literal">optional</code> or <code class="literal">required</code>.
</li>
<li class="listitem">
The interface must <em>trust</em> the certificate that is presented by the client
by configuring either the <code class="literal">truststore</code> or <code class="literal">certificate_authorities</code> paths,
or by setting <code class="literal">verification_mode</code> to <code class="literal">none</code>.
</li>
<li class="listitem">
The <em>protocols</em> supported by the interface must be compatible with those
used by the client.
</li>
</ul>
</div>
<p>For an explanation of these settings, see <a class="xref" href="security-settings.html#ssl-tls-settings" title="General TLS settings">General TLS settings</a>.</p>
<p>The relevant network interface (transport or http) must be configured to trust
any certificate that is to be used within the PKI realm. However, it is possible
to configure the PKI realm to trust only a <em>subset</em> of the certificates accepted
by the network interface. This is useful when the SSL/TLS layer trusts clients
with certificates that are signed by a different CA than the one that signs your
users' certificates.</p>
<p>To configure the PKI realm with its own truststore, specify the
<code class="literal">truststore.path</code> option. The path must be located within the Elasticsearch
configuration directory (<code class="literal">ES_PATH_CONF</code>). For example:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack:
  security:
    authc:
      realms:
        pki:
          pki1:
            truststore:
              path: "pki1_truststore.jks"</pre>
</div>
<p>If the truststore is password protected, the password should be configured by
adding the appropriate <code class="literal">secure_password</code> setting to the Elasticsearch keystore.  For
example, the following command adds the password for the example realm above:</p>
<div class="pre_wrapper lang-shell">
<pre class="programlisting prettyprint lang-shell">bin/elasticsearch-keystore add \
xpack.security.authc.realms.pki.pki1.truststore.secure_password</pre>
</div>
<p>The <code class="literal">certificate_authorities</code> option can be used as an alternative to the
<code class="literal">truststore.path</code> setting, when the certificate files are PEM formatted. The
setting accepts a list. The two options are exclusive, they cannot be both used
simultaneously.</p>
</li>
<li class="listitem">
<p>Map roles for PKI users.</p>
<p>You map roles for PKI users through the
<a class="xref" href="security-api.html#security-role-mapping-apis" title="Role mappings">role mapping APIs</a> or by using a file stored on
each node. Both configuration options are merged together. When a user
authenticates against a PKI realm, the privileges for that user are the union of
all privileges defined by the roles to which the user is mapped.</p>
<p>You identify a user by the distinguished name in their certificate.
For example, the following mapping configuration maps <code class="literal">John Doe</code> to the
<code class="literal">user</code> role using the role mapping API:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">PUT /_security/role_mapping/users
{
  "roles" : [ "user" ],
  "rules" : { "field" : {
    "dn" : "cn=John Doe,ou=example,o=com" <a id="CO475-1"></a><i class="conum" data-value="1"></i>
  } },
  "enabled": true
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/1223.console"></div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO475-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>The distinguished name (DN) of a PKI user.</p>
</td>
</tr>
</table>
</div>
<p>Alternatively, use a role-mapping file. For example:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">user: <a id="CO476-1"></a><i class="conum" data-value="1"></i>
  - "cn=John Doe,ou=example,o=com" <a id="CO476-2"></a><i class="conum" data-value="2"></i></pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO476-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>The name of a role.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO476-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>The distinguished name (DN) of a PKI user.</p>
</td>
</tr>
</table>
</div>
<p>The file’s path defaults to <code class="literal">ES_PATH_CONF/role_mapping.yml</code>. You can specify a
different path (which must be within <code class="literal">ES_PATH_CONF</code>) by using the
<code class="literal">files.role_mapping</code> realm setting (e.g.
<code class="literal">xpack.security.authc.realms.pki.pki1.files.role_mapping</code>).</p>
<p>The distinguished name for a PKI user follows X.500 naming conventions which
place the most specific fields (like <code class="literal">cn</code> or <code class="literal">uid</code>) at the beginning of the
name and the most general fields (like <code class="literal">o</code> or <code class="literal">dc</code>) at the end of the name.
Some tools, such as <em>openssl</em>, may print out the subject name in a different
format.</p>
<p>One way that you can determine the correct DN for a certificate is to use the
<a class="xref" href="security-api-authenticate.html" title="Authenticate API">authenticate API</a> (use the relevant PKI
certificate as the means of authentication) and inspect the metadata field in
the result. The user’s distinguished name will be populated under the <code class="literal">pki_dn</code>
key. You can also use the authenticate API to validate your role mapping.</p>
<p>For more information, see <a class="xref" href="mapping-roles.html" title="Mapping users and groups to roles">Mapping users and groups to roles</a>.</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>The PKI realm supports <a class="xref" href="realm-chains.html#authorization_realms" title="Delegating authorization to another realm">authorization realms</a> as an
alternative to role mapping.</p>
</div>
</div>
</li>
</ol>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="pki-realm-for-proxied-clients"></a>PKI authentication for clients connecting to Kibana<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/security/authentication/configuring-pki-realm.asciidoc">edit</a>
</h3>
</div></div></div>
<p>By default, the PKI realm relies on the node’s network interface to perform the
SSL/TLS handshake and extract the client certificate. This behaviour requires
that clients connect directly to Elasticsearch so that their SSL connection is terminated
by the Elasticsearch node.  If SSL/TLS authentication is to be performed by Kibana, the
PKI realm must be configured to permit delegation.</p>
<p>Specifically, when clients presenting X.509 certificates connect to Kibana,
Kibana performs the SSL/TLS authentication. Kibana then forwards the client’s
certificate chain (by calling an Elasticsearch API) to have them further validated by
the PKI realms that have been configured for delegation.</p>
<p>To permit authentication delegation for a specific Elasticsearch PKI realm, start by
configuring the realm for the usual case, as detailed in the
<a class="xref" href="pki-realm.html#pki-realm-for-direct-clients" title="PKI authentication for clients connecting directly to Elasticsearch">PKI authentication for clients connecting directly to Elasticsearch</a> section. In this scenario, when you enable TLS,
it is mandatory that you <a class="xref" href="configuring-tls.html#tls-http" title="Encrypting HTTP client communications">encrypt HTTP client communications</a>.</p>
<p>You must also explicitly configure a <code class="literal">truststore</code> (or, equivalently
<code class="literal">certificate_authorities</code>) even though it is the same trust configuration that
you have configured on the network layer. The
<code class="literal">xpack.security.authc.token.enabled</code> and <code class="literal">delegation.enabled</code> settings must also
be <code class="literal">true</code>. For example:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack:
  security:
    authc:
      token.enabled: true
      realms:
        pki:
          pki1:
            order: 1
            delegation.enabled: true
            truststore:
              path: "pki1_truststore.jks"</pre>
</div>
<p>After you restart Elasticsearch, this realm can validate delegated PKI authentication.
You must then
<a href="https://www.elastic.co/guide/en/kibana/7.7/kibana-authentication.html#pki-authentication" class="ulink" target="_top">configure Kibana to allow PKI certificate authentication</a>.</p>
<p>A PKI realm with <code class="literal">delegation.enabled</code> still works unchanged for clients
connecting directly to Elasticsearch. Directly authenticated users and users that are PKI
authenticated by delegation to Kibana both follow the same
<a class="xref" href="mapping-roles.html" title="Mapping users and groups to roles">role mapping rules</a> or
<a class="xref" href="realm-chains.html#authorization_realms" title="Delegating authorization to another realm">authorization realms configurations</a>.</p>
<p>If you use the <a class="xref" href="security-api.html#security-role-mapping-apis" title="Role mappings">role mapping APIs</a>, however, you
can distinguish between users that are authenticated by delegation and users
that are authenticated directly. The former have the extra fields
<code class="literal">pki_delegated_by_user</code> and <code class="literal">pki_delegated_by_realm</code> in the user’s metadata. In
the common setup, where authentication is delegated to Kibana, the values of
these fields are <code class="literal">kibana</code> and <code class="literal">reserved</code>, respectively. For example, the
following role mapping rule assigns the <code class="literal">role_for_pki1_direct</code> role to all users
that have been authenticated directly by the <code class="literal">pki1</code> realm, by connecting to Elasticsearch
instead of going through Kibana:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">PUT /_security/role_mapping/direct_pki_only
{
  "roles" : [ "role_for_pki1_direct" ],
  "rules" : {
    "all": [
      {
        "field": {"realm.name": "pki1"}
      },
      {
        "field": {
          "metadata.pki_delegated_by_user": null <a id="CO477-1"></a><i class="conum" data-value="1"></i>
        }
      }
    ]
  },
  "enabled": true
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/1224.console"></div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO477-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>If this metadata field is set (that is to say, it is <span class="strong strong"><strong>not</strong></span> <code class="literal">null</code>), the user
has been authenticated in the delegation scenario.</p>
</td>
</tr>
</table>
</div>
</div>

</div>
<div class="navfooter">
<span class="prev">
<a href="oidc-realm.html">« OpenID Connect authentication</a>
</span>
<span class="next">
<a href="saml-realm.html">SAML authentication »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>